archy/.gitea/workflows/demo-images.yml

name: Demo images

# Builds and pushes the public-demo images on every change to the UI / mock
# backend, so the separated `archy-demo` Portainer stack auto-tracks the real
# code (see demo-deploy/ and docs/demo-deployment-design.md).
#
# Required repo configuration:
#   vars.DEMO_REGISTRY        e.g. source.archipelago-foundation.org/lfg2025
#   vars.DEMO_REGISTRY_HOST   registry host for docker login (no org suffix)
#   secrets.DEMO_REGISTRY_USER
#   secrets.DEMO_REGISTRY_TOKEN
# Optional:
#   secrets.PORTAINER_WEBHOOK  redeploy hook called after a successful push

on:
  push:
    branches: [main]
    paths:
      - 'neode-ui/**'
      - 'aiui/**'
      - 'scripts/build-aiui.sh'
      - '.dockerignore'
      - 'docker-compose.demo.yml'
      - '.gitea/workflows/demo-images.yml'
  workflow_dispatch:
    inputs:
      operation:
        description: Build and deploy the demo, or clean disposable runner storage
        type: choice
        options: [build, storage]
        default: build
        required: false

jobs:
  build:
    name: Build & push demo images
    runs-on: ubuntu-latest
    # Skip cleanly on forks / before registry config is set.
    if: ${{ vars.DEMO_REGISTRY != '' && inputs.operation != 'storage' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check runner storage
        run: |
          df -h /
          docker system df
          used=$(df -P / | awk 'NR == 2 {gsub(/%/, "", $5); print $5}')
          if [ "$used" -ge 85 ]; then
            # Only unused cache and untagged images older than a week.
            # Running containers, tagged images and volumes are preserved.
            docker builder prune --force --filter until=168h --keep-storage 10GB
            docker image prune --force --filter until=168h
            df -h /
            docker system df
          fi

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          # Use the public HTTPS registry, including for BuildKit pushes.
          # Plain HTTP redirects can change upload POST requests into GET requests.
          buildkitd-config-inline: |
            [registry."${{ vars.DEMO_REGISTRY_HOST || vars.DEMO_REGISTRY }}"]
              http = false

      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.DEMO_REGISTRY_HOST || vars.DEMO_REGISTRY }}
          username: ${{ secrets.DEMO_REGISTRY_USER }}
          password: ${{ secrets.DEMO_REGISTRY_TOKEN }}

      - name: Build & push backend
        uses: docker/build-push-action@v6
        with:
          context: .
          file: neode-ui/Dockerfile.backend
          push: true
          tags: |
            ${{ vars.DEMO_REGISTRY }}/archy-demo-backend:demo
            ${{ vars.DEMO_REGISTRY }}/archy-demo-backend:${{ github.sha }}

      - name: Build & push web
        uses: docker/build-push-action@v6
        with:
          context: .
          file: neode-ui/Dockerfile.web
          push: true
          build-args: |
            VITE_DEMO=1
            SOURCE_REVISION=${{ github.sha }}
          tags: |
            ${{ vars.DEMO_REGISTRY }}/archy-demo-web:demo
            ${{ vars.DEMO_REGISTRY }}/archy-demo-web:${{ github.sha }}

      - name: Trigger Portainer redeploy
        # Source pushes prepare images; public deployment is an explicit post-release action.
        if: ${{ success() && github.event_name == 'workflow_dispatch' && secrets.PORTAINER_WEBHOOK != '' }}
        run: curl -fsS -X POST "${{ secrets.PORTAINER_WEBHOOK }}"

  storage:
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.operation == 'storage' }}
    runs-on: ubuntu-latest
    steps:
      - name: End previous diagnostic log read
        run: |
          for container in $(docker ps --quiet --filter name=GITEA-ACTIONS-TASK-1640-); do
            docker exec "$container" pkill -TERM -f '^docker logs --since 30m --tail 2000 gitea$' || true
          done
      - name: Inspect runner storage and demo services
        run: |
          df -h /
          df -i /
          docker system df
          docker ps --format '{{.Names}}  {{.Image}}'
          docker volume ls --filter dangling=true
      - name: Inspect registry storage errors
        run: |
          docker exec gitea sh -c 'df -h /data; du -h -d 2 /data/gitea 2>/dev/null | sort -h | tail -n 20'
          free -h
          docker stats --no-stream --format '{{.Name}} {{.MemUsage}}'
          log_path=$(docker inspect gitea --format '{{.LogPath}}')
          log_dir=$(dirname "$log_path")
          timeout 20 docker run --rm --entrypoint sh --mount "type=bind,src=$log_dir,dst=/registry-logs,readonly" gitea/gitea:1.27.1 -c 'grep -h "2026/11/12" /registry-logs/*-json.log.1 /registry-logs/*-json.log | grep -Ei "blobs/uploads|git-receive-pack|database is locked|no space|failed|error" | tail -n 60' || true
          docker exec nginx-proxy-manager-app-1 sh -c 'for f in $(grep -l source.archipelago-foundation.org /data/nginx/proxy_host/*.conf); do echo "$f"; grep -E "server_name|proxy_pass|client_body|proxy_request|proxy_buffer" "$f"; n=$(basename "$f" .conf); grep -E "blobs/uploads|git-receive-pack" "/data/logs/proxy-host-${n}_error.log" | tail -n 30; cat /data/nginx/custom/server_proxy.conf; done'

          docker inspect gitea --format 'restarts={{.RestartCount}} logging={{.HostConfig.LogConfig.Type}}'
          docker inspect archy-demo-web archy-demo-backend --format '{{.Name}} service={{index .Config.Labels "com.docker.compose.service"}}' 
          docker inspect archy-demo-web archy-demo-backend --format '{{.Name}} image={{.Config.Image}} compose={{index .Config.Labels "com.docker.compose.project"}} files={{index .Config.Labels "com.docker.compose.project.config_files"}}'

      - name: Remove stale disposable CI volumes
        run: |
          cutoff=$(date -d '24 hours ago' +%s)
          docker volume ls --quiet --filter dangling=true | while read -r volume; do
            case "$volume" in
              GITEA-ACTIONS-TASK-*|buildx_buildkit_*_state)
                created=$(docker volume inspect --format '{{.CreatedAt}}' "$volume")
                created_seconds=$(date -d "$created" +%s)
                if [ "$created_seconds" -lt "$cutoff" ]; then
                  # Docker refuses removal if a container began using it.
                  docker volume rm "$volume"
                fi
                ;;
            esac
          done
          docker builder prune --force --filter until=168h --keep-storage 512MB
          docker image prune --force --filter until=168h
          df -h /
          docker system df